Adb is still active

[ghost]

TWRP-Protect is good provides security
However adb is still active in rwcovery and therefore can still be used without enterin the password

[ant9000]

The script should take care of blocking adb access from any unauthorized computer (see https://github.com/ant9000/TWRP-protect/blob/master/protect.py#L140=). I can confirm that it works correctly on my TWRP instance. Can you boot into your recovery and check the value of ro.adb.secure? If it is set to 1, it should be fine.

If you can access and are not sure why, try removing all debug authorizations from Android, then reboot into recovery: you should be unable to authenticate.